iOS: save the recovery phrase to Passwords, and restore from it

[jvsena42]

Closes #472. Stacked on #475.

Do not merge until jvsena42/loopky.github.io#23 is deployed and this has been run on a device. See "Not verified".

What the spike found

• SecAddSharedWebCredential still compiles against the current SDK and works: on a simulator it raises the system alert "Would you like to save this password in your iCloud Keychain…".
• After saving, ASAuthorizationPasswordRequest raises the "Sign In" sheet naming the credential by the account's full pubky.
• So the "permanent no" in IosPasswordManagerPresence was wrong for a domain-scoped credential. canSave() is now true.

What changed

• PasswordManagerSheet.swift: save and read, no Kotlin binding, same split as SpeechListener.
• Loopky.entitlements: webcredentials:loopky.app.
• Backup menu card, the save button on the phrase screen, and the saved-phrase confirm step, all of which existed only on Android.
• Restore menu's third card and the phrase screen's secondary button, matching Password manager: restore from it, and key the credential by pubky #475.
• Thirteen strings in all eleven localizations. Twelve are ported from Android. backup_method_password_manager_detail is new copy naming Apple's Passwords app, because the Android text names Google Password Manager.

The shared ViewModels are unchanged.

Verification

• xcodebuildmcp simulator build succeeds; ./gradlew lintSwift checkStringPlurals pass.
• iPhone 17e simulator, signed in: backup menu shows the card; the save button appears after reveal; tapping it raises the save alert; "Save Password" is followed by the "Sign In" sheet for the right pubky.
• iPad mini simulator, signed out: restore menu shows three cards; the manager card raises the read on entry, nothing is saved there, and the screen shows restore_phrase_manager_empty with the field editable.

Not verified

• Accepting the "Sign In" sheet. It ignores synthetic input (snapshot-ui does not list it; AXe taps do nothing), so the verified state, the tick on the backup menu, the confirm step and a restore from a saved entry were not driven. It takes one tap by hand in the Simulator.
• Anything on a device. The simulator saved while the live AASA has no webcredentials entry, so it does not enforce the association. A device does. Until the site PR is live and Apple's CDN has it, a device save should fail with backup_phrase_manager_failed.
• Third-party managers (1Password, Bitwarden). The save goes to iCloud Keychain; whether the read sheet lists other providers is unknown. The card's copy says "Apple's Passwords app" for that reason.
• A personal (free) team cannot sign Associated Domains at all; Config.xcconfig already says how to blank the entitlement.

journeys/28 has the device steps and journeys/README.md records the above.

🤖 Generated with Claude Code

[jvsena42]

Two findings, both needing a device or a hand on the Simulator to settle. The thirteen catalog keys exist in all eleven localizations and none carries a format specifier.